Password Reset Mechanism Vulnerability in Zitadel Identity Infrastructure
CVE-2025-48936
What is CVE-2025-48936?
A vulnerability exists in the Zitadel identity infrastructure software related to its password reset mechanism. The software uses the Forwarded or X-Forwarded-Host header to create a password reset confirmation link sent via email, which includes a secret code for resetting the user's password. If an attacker successfully manipulates these headers through host header injection, they can craft a malicious password reset link that leads to an unauthorized domain. If a user clicks this link, the attacker could capture the secret reset code and gain unauthorized access to the user’s account. This vulnerability is effectively mitigated for accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled. Users are urged to update to versions 2.70.12, 2.71.10, or 3.2.2, where this issue has been addressed.
Affected Version(s)
zitadel < 2.70.12 < 2.70.12
zitadel >= 2.71.0, <= 2.71.10 <= 2.71.0, 2.71.10
zitadel >= 3.0.0-rc1, < 3.2.2 < 3.0.0-rc1, 3.2.2